The global financial system involves trillions of dollars, and the lives and fortunes of millions depend on its overall integrity. Trade surveillance and monitoring (TSM) systems are commonplace within financial institutions and in many cases exist because of legal and regulatory demands. In general, a TSM system at an institution helps monitor the trading activity of that institution's employees, e.g., to ensure that their trading activity adheres to trading rules and regulations. For instance, TSM systems generally try to identify, and sometimes seek to prevent, illicit trading activity. Illicit trading activity in this sense can include manipulation of the financial markets, abuse of the organization's internal inventory, off-exchange collusion, misuse of reporting and auditing systems, and/or the like, and can include the behavior of so-called “rogue traders.” Such illicit activity sometimes can subject both individual traders and the officers within an organization to civil and criminal liability, precisely because the impact of market abuses might be so widely felt.
Monitoring of actions may take place over a variety of different communication channels such as, for example, actions that take place with respect to electronic markets, social media, telephony, chat systems, email, etc. Some existing trade surveillance and monitoring systems monitor one or more of these systems to try to ascertain whether there is any explicit illegal activity or (more often) whether there is a situation that requires further “off-line” or after-the-fact analysis. An assessment of wrongdoing could trigger internal probes, criminal investigations, civil lawsuits, and/or the like.
Although the identification of illicit behavior via off-line or after-the-fact analysis and subsequent enforcement action against those deemed responsible may help improve the integrity of financial markets and/or the like over time (e.g., by serving as a deterrent), it will be appreciated that it would be desirable to develop more real-time detection techniques. It furthermore would be desirable to develop and implement more real-time response strategies. For instance, by identifying potential risks in real-time, not only can illicit trades be prevented, but such activities might not be able to impact the market and thus affect every other trader and trading venue worldwide. Indeed, even if potential problems are detected in real-time, if bona fide wrongdoing takes place, the effects on the market are potentially unforeseeable and irreversible, e.g., because it is not possible to “undo” a day's worth of trades, “re-form” the subjective impressions caused by fraudulent activities, etc. The potential impacts of wrongdoing thus can be both subtle and explicit, with both potential impact types being difficult or even impossible to unwind.
Certain example embodiments extend existing trade surveillance and monitoring solutions, e.g., to encompass real-time and non-real-time detection, analysis, and/or resolution techniques. For instance, certain example embodiments implement systems and/or methods that continually and passively monitor the emotional states of traders to help identify illicit behavior from information streams not accessible or identifiable by existing systems. This more subjective information may be derived from visual surveillance systems, social media feeds, email messages, physiological monitors, etc., and it may be considered in connection with other more objective information such as, for example, trading activity, financial market activity, etc. Certain example embodiments additionally provide real-time responses to real-time problem cases.
In certain example embodiments, a surveillance system is provided. The system includes processing resources including at least one processor, a first interface over which quantified representations of inferred emotional states of one or more individuals are electronically receivable, and a second interface over which representations of activities undertaken by one or more individuals are electronically receivable. The processing resources are configured to at least: dynamically perform a set of first pre-programmed scenarios in real-time as events continue to stream into the system via the first and second interfaces to determine whether an incident might be occurring and/or might have occurred, with each said first scenario being implemented as a logic sequence that takes into account at least an aspect of a representation of an activity and/or an aspect of a representation of an inferred emotional state, and with at least one of said first scenarios taking into account both an aspect of a representation of an activity undertaken by at least one given individual and an aspect of a representation of an inferred emotional state of the at least one given individual; and dynamically generate a real-time alert message and/or at least temporarily halt an action before it can be completed, in response to a determination that a given incident might be occurring and/or might have occurred with a likelihood greater than a predetermined threshold.
In certain example embodiments, a method of conducting surveillance in connection with a computer system that monitors trades made by individuals in connection with at least one market is provided. Quantified representations of inferred emotional states of one or more of the individuals are received over a first electronic interface of the computer system. Representations of activities undertaken by one or more of the individuals are received over a second electronic interface of the computer system. Using at least one processor, a set of first predefined scenarios is dynamically performed in real-time as events continue to stream in to the computer system via the first and second interfaces, to determine whether an illicit incident might be occurring and/or might have occurred in connection with the trades, with each said first scenario being representable as program logic that includes at least an aspect of a representation of an activity and/or an aspect of a representation of an inferred emotional state, with at least one of said first scenarios including both an aspect of a representation of an activity undertaken by at least one given individual and an aspect of a representation of an inferred emotional state of the at least one given individual, and with the first scenarios being stored to a non-transitory computer readable storage medium. A real-time electronic message is dynamically generated in response to a determination that a given illicit incident might be occurring and/or might have occurred with a likelihood greater than a predetermined threshold.
According to certain example embodiments, the processing resources may be further configured to at least perform, in dependence on a determination that a given incident might be occurring and/or might have occurred, a set of second pre-programmed scenarios to determine with greater certainty whether the given incident might be occurring and/or might have occurred, with each said second scenario being implemented as a logic sequence, and with the first and second scenarios being different from one another.
According to certain example embodiments, aspects of representations of activities may include trade-related activities themselves and/or results from computations applied thereto. Similarly, according to certain example embodiments, aspects of representations of inferred emotional states may include quantifications of perceived subjective emotional feelings including happiness, sadness, anger, shock, and/or agitation themselves, and/or results from computations applied thereto.
Non-transitory computer readable storage mediums tangibly storing instructions for performing the above-summarized and/or other approaches also are provided by certain example embodiments, as well as corresponding computer programs.
For instance, in certain example embodiments, there is provided a non-transitory computer readable storage medium tangibly storing instructions that, when executed, perform surveillance in connection with a computer system that monitors trades made by individuals in connection with at least one market by at least: enabling reception, over a first electronic interface of the computer system, of quantified representations of inferred emotional states of one or more of the individuals; enabling reception, over a second electronic interface of the computer system, of representations of activities undertaken by one or more of the individuals; dynamically performing a set of first predefined scenarios in real-time as events continue to stream in to the computer system via the first and second interfaces, to determine whether an illicit incident might be occurring and/or might have occurred in connection with the trades, each said first scenario being representable as program logic that includes at least an aspect of a representation of an activity and/or an aspect of a representation of an inferred emotional state, at least one of said first scenarios including both an aspect of a representation of an activity undertaken by at least one given individual and an aspect of a representation of an inferred emotional state of the at least one given individual; performing, in dependence on a determination that a given illicit incident might be occurring and/or might have occurred, a set of second predefined scenarios to determine with greater certainty whether the given illicit incident might be occurring and/or might have occurred, each said second scenario being representable as program logic, the first and second scenarios being different from one another; and dynamically generating a real-time alert message and/or at least temporarily halting an action before it can be completed, in response to a determination that a given illicit incident might be occurring and/or might have occurred with certainty greater than a predefined threshold.
In certain example embodiments, a trade surveillance system is provided. The system includes: processing resources including at least one processor, a first interface over which quantified representations of inferred subjective physical trader emotional attributes are electronically receivable, and a second interface over which objective trade-related activity events and associated measures are electronically receivable. The processing resources are configured to at least: perform in real-time first logical sequences that define respective types or patterns useful in detecting inappropriate trade-related incidents in connection with data types receivable over at least the first interface, using a complex event processing engine; perform in real-time second logical sequences that incorporate data types from the first and/or second interfaces to provide additional context in investigating incidents detected using the first logical sequences; and generate real-time messages and/or trade interrupt signals, responsive to the performance of the first and/or second logical sequences.
These features, aspects, advantages, and example embodiments may be used separately and/or applied in various combinations to achieve yet further embodiments of this invention.